Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 12:20
Static task
static1
Behavioral task
behavioral1
Sample
54b113a41ad2126cb2117b6a3e789cb2_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
54b113a41ad2126cb2117b6a3e789cb2_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
54b113a41ad2126cb2117b6a3e789cb2_JaffaCakes118.exe
-
Size
214KB
-
MD5
54b113a41ad2126cb2117b6a3e789cb2
-
SHA1
18199911c5c006a2d3598d8c85750133a5eb0f37
-
SHA256
975f8a47bc86b60a12efccc60a2bb2f8e02bbb6cec78d918f26df82114870ca8
-
SHA512
009c65f9e721c3f9f6e2fc7431a482b48e5f30edd796341899cfd3d2e565a9ce32213a02e4a15f79127d9349e328d488a8a553fcc215df5de30c2ed1969d9070
-
SSDEEP
3072:sjdh27K4tfd81LgfoKO8DLxnYDgbACrs:snYFtdQ0nlhnDbFr
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1320 1588 WerFault.exe winver.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
winver.exepid process 1588 winver.exe 1588 winver.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Explorer.EXEdescription pid process Token: SeShutdownPrivilege 3484 Explorer.EXE Token: SeCreatePagefilePrivilege 3484 Explorer.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
winver.exepid process 1588 winver.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3484 Explorer.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
54b113a41ad2126cb2117b6a3e789cb2_JaffaCakes118.exewinver.exedescription pid process target process PID 3052 wrote to memory of 1588 3052 54b113a41ad2126cb2117b6a3e789cb2_JaffaCakes118.exe winver.exe PID 3052 wrote to memory of 1588 3052 54b113a41ad2126cb2117b6a3e789cb2_JaffaCakes118.exe winver.exe PID 3052 wrote to memory of 1588 3052 54b113a41ad2126cb2117b6a3e789cb2_JaffaCakes118.exe winver.exe PID 3052 wrote to memory of 1588 3052 54b113a41ad2126cb2117b6a3e789cb2_JaffaCakes118.exe winver.exe PID 1588 wrote to memory of 3484 1588 winver.exe Explorer.EXE PID 1588 wrote to memory of 2760 1588 winver.exe sihost.exe
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\54b113a41ad2126cb2117b6a3e789cb2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\54b113a41ad2126cb2117b6a3e789cb2_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 6364⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1588 -ip 15881⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1588-8-0x00000000773A2000-0x00000000773A3000-memory.dmpFilesize
4KB
-
memory/1588-4-0x0000000001390000-0x0000000001397000-memory.dmpFilesize
28KB
-
memory/1588-14-0x0000000001390000-0x0000000001397000-memory.dmpFilesize
28KB
-
memory/1588-7-0x0000000001390000-0x0000000001397000-memory.dmpFilesize
28KB
-
memory/2760-12-0x0000000000380000-0x0000000000387000-memory.dmpFilesize
28KB
-
memory/2760-16-0x00007FF8018D0000-0x00007FF8018D1000-memory.dmpFilesize
4KB
-
memory/2760-13-0x0000000000380000-0x0000000000387000-memory.dmpFilesize
28KB
-
memory/3052-0-0x0000000000560000-0x0000000000572000-memory.dmpFilesize
72KB
-
memory/3052-1-0x0000000000401000-0x0000000000405000-memory.dmpFilesize
16KB
-
memory/3052-2-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/3484-9-0x00007FF80174D000-0x00007FF80174E000-memory.dmpFilesize
4KB
-
memory/3484-10-0x00007FF8018E0000-0x00007FF8018E1000-memory.dmpFilesize
4KB
-
memory/3484-3-0x00000000021B0000-0x00000000021B7000-memory.dmpFilesize
28KB
-
memory/3484-6-0x00000000021B0000-0x00000000021B7000-memory.dmpFilesize
28KB